Exam NGFW-Engineer topic 1 question 31 discussion

Actual exam question from Palo Alto Networks's NGFW-Engineer

Question #: 31
Topic #: 1

A large enterprise wants to implement certificate-based authentication for both users and devices, using an on-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy as the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status updates and reduce the overhead on its NGFWs. The environment includes multiple Active Directory forests, Panorama management for several geographically dispersed firewalls, GlobalProtect portals and gateways needing distinct certificate profiles for users and devices, and strict Security policies demanding frequent revocation checks with minimal latency.
Which approach best addresses these requirements while maintaining consistent policy enforcement?

A. Deploy self-signed certificates at each site to simplify local certificate validation and reduce dependencies on a centralized CTurn off certificate revocation checks for lower overhead, rely on IP-based rules for GlobalProtect authentication, and use a single certificate profile for both users and devices.
B. Distribute the root and intermediate CA certificates via Panorama as shared objects to ensure all firewalls have a consistent trust chain. Configure OCSP responder profiles on each firewall to offload revocation checks to an internal OCSP server while keeping CRL checks as a fallback. Maintain separate certificate profiles for user and device authentication and use an automated enrollment method – such as Group Policy or SCEP – to deploy certificates to endpoints.
C. Configure each firewall independently to trust the root and intermediate CA certificates. Rely only on manual CRL checks for certificate revocation, and import both user and device certificates directly into each firewall’s local certificate store for authentication.
D. Obtain wildcard certificates from a public CA for both user and device authentication, and configure firewalls to perform CRL polling at the default update interval. Manually install user certificates on endpoints and synchronize firewall certificate stores through frequent manual SSH updates to maintain consistency.

Show Suggested Answer

Suggested Answer: B 🗳️

by Seidor_Analytics at July 29, 2025, 5:50 a.m.

Comments

Submit Cancel

Kane4555

1 week, 1 day ago

B Another question where only one answer uses every part of the question. A. Enterprise requires OCSP, turning off revocation checks is out C. Enterprise requires OCSP, manual CRL checks are out D. Enterprise requires OCSP, CRL polling is out.

upvoted 1 times

...

Seidor_Analytics

2 weeks, 3 days ago

Selected Answer: D

Feels like D is the one. Does anyone disagree?

upvoted 1 times

...